Recover a Hacked X Account With Attacker-Set 2FA
The attacker's own two-factor method now blocks you from signing back in.
Is this your situation?
You can no longer sign in to your account. The login now asks for a two-factor authentication code or passkey that you did not set up.
Do this first
Do not try the password repeatedly. A user should change their password from the Password tab in settings if the account is compromised. If a user still cannot log in after attempting a password reset, they can contact support by submitting a Support Request.
Which situation is yours?
- You can still log in: change your password now.
- You are locked out entirely: submit a support request.
- You suspect phishing caused this: review compromised account guidance.
- You see unexpected posts or messages: your account shows compromise signs.
- You lost your email access too: find guidance for that case.
- A third-party app may be at fault: revoke any you don't recognize.
How X handles this
- Account ownership can be verified by phone, email or recaptcha.
- If an account appears hacked or phished, X may proactively reset the password to revoke the hacker's access.
- When X proactively resets a password, it emails the account's real owner with reset instructions.
- If you still cannot log in after resetting your password, you can submit a support request.
Which recovery path is yours?
- Can you still log in to the account? A user should change their password from the Password tab in settings if the account is compromised.
- Are you logged out and cannot sign in at all? If logged out, a user can go to Login and click Forgot Password to reset their password.
- Did the password reset still fail to restore access? If a user still cannot log in after attempting a password reset, they can contact support by submitting a Support Request.
- Submitting a request, what should you include? The user should use the email address associated with the compromised account, because X will send additional information and instructions to that email address.
What not to do
- Retrying the old password repeatedly A password that no longer works and prompts a reset can indicate the account has been compromised.Why it happens: You expect the old password to still work and keep trying it.
- Leaving third-party apps connected A user should visit Apps in settings while logged in to revoke access for any application they don't recognize.Why it happens: Accounts may become compromised if credentials were entrusted to a malicious third-party application.
- Submitting a support request without the right details The user should include both their username and the date they last had access to their account.Why it happens: X sends additional information and instructions to the email address associated with the compromised account.
What to have ready
- Your current login access Check whether you can sign in. Try logging in with your username and password.
- The account's email address Confirm you can access the linked email. Check your inbox for X security messages.
- Recent unexpected posts Unexpected posts can indicate compromise. Review your posts for anything you did not write.
- Unapproved account behaviors Unapproved following or blocking can indicate compromise. Check your following and blocked lists.
- Connected third-party apps Visit Apps in settings to revoke unrecognized apps. Open the Apps section in settings.
- Your username and last access date Include your username and last access date. Write down the date you last had access.
Stop this happening again
Two-factor authentication introduces a second check beyond a password so only the account owner can access the account. Set up two-factor authentication in a way that matches what you want for your account.
Quick reference
| Situation | What to do |
|---|---|
| Still logged in | Change your password from the Password tab in settings. |
| Logged out entirely | Click Forgot Password at Login to reset your password. |
| Reset did not work | Submit a support request to contact the support team. |
| Support request contents | Include your username and the date you last had access. |
| Third-party apps | Visit Apps in settings to revoke access for apps you don't recognize. |
| Cause to check | Accounts may become compromised if credentials were given to a malicious third-party application. |
| Signs of compromise | Unexpected posts by the account can indicate it has been compromised. |
| Email lost too | A user who has lost access to the linked email can find guidance on what to do. |
Keeping track of who has access
Situations like this are preventable when access and its second factors are set up with intent rather than left to chance. Delvia is the structure that keeps a record of who holds access and how, before an attacker can claim it. That record is what turns a recovery scramble into a known, reviewable arrangement.
Was this helpful?